Developer Quotas & Fair-Use Limits
OpenID Connect & OAuth 2.0 identity integration is free for every application. No subscriptions, credit cards, or surprise paywalls.
Standard Allocation per Developer
Each developer account receives generous default allowances to build, test, and run production applications:
Create up to 5 distinct client apps with instant Client ID and secret generation.
Unique signed-in users per calendar month across all your client integrations.
Sustained throughput on /oidc/token with burst headroom up to 300 req/min.
Configure multiple callback URLs for local dev, private Wi-Fi IPs, staging, and production.
Included for Every Integration
All developer features are unlocked by default with zero tiered gates:
- ✓ OpenID Connect Core 1.0 compliant
- ✓ OAuth 2.0 PKCE S256 (RFC 7636)
- ✓ Public JWKS Keystore & Key Rotation (kid)
- ✓ RS256 Bearer Token mathematical verification
- ✓ RFC 1918 Private LAN host header rewriting
- ✓ Plain HTTP dev mode without invalid SSL blocks
- ✓ BroadcastChannel
sso_auth_busmulti-tab sync - ✓ Seamless popup login without parent reloading
- ✓ 30-day soft-delete grace period & audit logs
- ✓ Strict origin matching against open-redirects
- ✓ FIDO2 WebAuthn Passkeys & Social Logins
- ✓ Help Center & Community Support (Standard 48-Hour Response SLA)
Need Higher Throughput or More Apps?
If your legitimate ecosystem project requires more than 5 apps or 10,000 MAU, contact support for a free quota expansion.
Frequently Asked Questions
Everything you need to know about developer allowances, limits, and fair use.
Is developer registration really 100% free?
Yes. We do not require credit cards, payment subscriptions, or commercial licensing. The developer hub is built to enable open, seamless identity integration across all consumer and administrative web properties.
What counts as a Monthly Active User (MAU)?
An MAU is any unique user (identified by their immutable sub claim) who initiates a session, exchanges an authorization code, or requests a userinfo claim through your registered client within a calendar month. Repeated logins by the same individual count as 1 MAU.
Are local development and private LAN testing counted against quotas?
No. Redirect URIs using localhost, 127.0.0.1, or private RFC 1918 subnets (192.168.*, 10.*, 172.16-31.*) are strictly for testing and do not consume your production active user quotas.
What happens if my application exceeds the rate limit?
If your app temporarily exceeds 120 req/min, the edge gateway returns an HTTP 429 Too Many Requests with a Retry-After header. The burst headroom of 300 req/min accommodates sudden traffic surges.